Hot answers tagged

267

Just because they won't use it, doesn't mean someone else won't find it and use it. A backdoor is a built-in vulnerability and can be used by anyone. You should explain that doing something like this is very risky for your company. What happens when some malicious attacker finds this backdoor and uses it? This will cost your company a lot of time and money ...


132

That's a pointless exercise. Most malware scanners match on fragments of binary code (aka virus signatures), and they look for MD5 hashes of known infected code. Unless the virus you wrote has been deployed into the wild, there isn't a chance they'll have your code's exact signatures on file. The scanners that do trigger a match are most likely those ...


95

If you've informed decision-makers and they've decided not to do anything about it, then by definition your company is knowingly shipping a product with a serious security vulnerability. (And, I assume, hiding it from their customers.) This is a very serious matter. What's the worst that a malicious person with access to this backdoor could do? If it's ...


77

To quote their FAQ: Aren’t you worried hackers will use your site to find targets? Yes, but less worried than having this information remain secret and relying on Security Through Obscurity. To be more verbose: There are two possible outcomes from submitting a site there: They fix it - This is more likely to happen when they get publicly shamed. ...


77

If there is a teacher or counselor you can trust completely, that you know will keep your name secret even if the school administration starts making threats about firing people, I'd go to them first and talk to them in private. They don't need to understand computers or security (and you don't need to go into detail about the issue), they just need to be ...


66

It sounds like your issue is that this vulnerability is bigger than you know what to do with. The rules of responsible disclosure, as decribed here, say that you should contact the vendor and negotiate a period of time - between 1 week and 6 months, depending on the depth of the changes required - in which they can implement a patch, revoke and re-issue ...


58

Please, pardon my cynicism, but this isn't the first and won't be the last backdoor we see in our legitimate, hardly-earned apps and devices. Just to refresh our memory, we can start from the most recent one, the new Amazon's Big Brother Kindle [1][2]. But we have an entire plethora of backdoored software and services, such as PGP Disk Encryption [3][4], ...


55

Simply reporting that it is using HTTP rather than HTTPS for login and that that is insecure shouldn't get you accused of hacking. It is something immediately publicly visible from looking at the site. There are many ways of detecting vulnerabilities which could actually be considered hacking (for example, running a vulnerability scanner against a target ...


55

Another thought struck me as I re-read your question (emphasis mine): How should I tell school that they are vulnerable when I wasn't given permission to check? Could you get permission? Once you have permission, you could "discover" the issue (without telling anyone you'd found it before) and report it without worrying about being blamed for hacking ...


54

Excellent question. Yes, your understanding is correct, as well as your rationale behind it. Staggering roll outs for new features often makes good sense. Staggering roll outs for security patches rarely is a good idea. As you pointed out, this gives even more opportunity for the vulnerabilities to be exploited. Perhaps even more importantly, the ...


51

If they don't see it as a big deal, you're not asking them the right question. The question to motivate action on this isn't "is this right?" but "what happens to us when somebody finds and publishes this?" Whether you're a big or small company, you're looking at serious damage to your reputation and all the bad things that go along with it if someone ...


38

A zero-day attack is an attack that relies on an undisclosed vulnerability in the design or implementation of a system in order to violate its security. Most commonly, such attacks consist of using zero-day exploits to access information systems or execute code on privileged systems. Such exploits are called 'zero-day' because security administrators have ...


35

The notion that open source software is inherently more secure than closed source software -- or the opposite notion -- is nonsense. And when people say something like that it is often just FUD and does not meaningfully advance the discussion. To reason about this you must limit the discussion to a specific project. A piece of software which scratches a ...


34

It is legal to tell them about the bug, giving them a detailed description of the bug and how you came across it. What is unpredictable is the company's reaction. It could vary to something such as them sending you a reward/small gift (has happened to me), to them trying to prosecute you as a criminal (tipping them off anonymously could help with this ...


34

Such a claim is generally quite serious. While reaching out to the vendor in question is a responsible matter, you should certainly consider notifying the relevant root store security teams, since they are responsible for designing, evaluating, and applying the security controls to prevent this, and will likely need to directly work with the CA to ascertain ...


32

If you want to do a good turn, you can report the malicious site to several centralized sources. There are some companies that maintain centralized lists of malicious web sites, and you can report the web sites to those companies. Here are some places you can report phishing sites: Report a phishing site to Google Report a phishing site to Symantec ...


32

You should seriously consider going to some governmental or regulatory authority with this, just to protect yourself. Imagine this scenario: You inform management about the backdoor. Now they know you know. Evil Hacker ZmEu finds out about the backdoor, and puts something on pastebin. Your management finds out about Evil Hacker ZmEu's pastebin. Your ...


30

No. You should always assume that the attacker knows everything. Security by obscurity is considered bad practice by most non-govt developers and architects. The obstacle it provides is minimal, and if something is kept secret, it may be so to hide a flaw. Kerckhoffs's principle is important to look at. Edit: This answer discusses security by obscurity in ...


28

In Canada it appears as though that you're safe ... for now. Anywhere else, it depends on whether by "search bugs" you mean to find exploits on someone's site that might violate their Terms and Conditions of usage for the website (Eg. Penetration Testing). There are a couple of different ways this could go, depending on the reaction of the person who ...


27

For the future, there is one critical thing you should be doing: Provide an easy way for people to report security bugs to you. I took a look at the web page for your application, and I noticed it doesn't seem to list any way for a security researcher to contact you with a report of a security vulnerability. There is no email address to report security ...


27

If they ignore your emails, you may try reporting them to organisation responsible for enforcing Data Protection Act. I don't know where are you from, in UK it would be http://ico.org.uk/concerns They have a responsibility to keep your data safe.


26

It's ok, people will still buy the iPhones your company makes - your secret is safe. ;) If it was my workplace, where I'm employed as a security analyst, I'd accept that my job is to identify and communicate risk; it's up to the business to accept the risk. I can not accept risk personally, so my only real option is to ensure that I've communicated the ...


25

Maintained software is more secure than software which is not. Maintenance effort being, of course, relative to the complexity of said software and the number (and skill) of people who are looking at it. The theory behind opensource systems being more secure is that there are "many eyes" which look at the source code. But this depends quite a lot on the ...


24

You should let the developer(s) know privately so that they have a chance to fix it. After that, if and when you go public with the vulnerability, you should allow the developer enough time to fix the problem and whoever is exposed to it enough time to upgrade their systems. Personally, I would allow the developer to make the announcement in a security ...


24

Congratulations! Sounds like a major find. First, generate some proof. The github.com SSL certificate sounds like a great start. Make sure you keep all the network traces you need to show exactly what happened. You need to determine if you broke any laws or T&Cs while doing this. If the CA does not have a bug bounty, you almost certainly did. In that ...


22

Before the smartphone area it was a standard feature of all mobile phone to have backdoors. The GSM protocol allowed the base station to update the phone software. http://events.ccc.de/congress/2009/Fahrplan/events/3654.en.html is a good talk about how crazy the security scheme has been. As far as I know no one of the companies involved in creating GSM got ...


21

Don't provide any information to anyone unless its absolutely necessary. You should set expose_php=off in your PHP.ini. This tells PHP not to expose the "x-powered-by" HTTP header as well as the strange quarks that can be used to identify it. You should also set display_errors=Off which could be used to identify PHP as well as error-based vulnerabilities ...


18

Personally I think Responsible disclosure seems to be the best way to go from an ethical point and worked well for Dan Kaminsky revealing the details of the DNS cache poisoning vulnerability. But it all depends greatly on the company or group you are dealing with and also the user base that it will affect.


18

When unsure, you can also contact CERT: https://forms.cert.org/VulReport/ They have experience in dealing with even very serious security vulnerabilities, and are generally considered a trusted party. At least they can confirm that your assessment of the vulnerability is correct, and document your part in finding it. While CERT generally advises you to ...


16

In the 'white' sense, the most well known companies that pay researchers to buy vulnerabilities or exploits are: Zero Day Initiative (ZDI) by TippingPoint: http://www.zerodayinitiative.com/ iDefense http://labs.idefense.com/vcp/ iSight https://gvp.isightpartners.com SecuriTeam http://www.beyondsecurity.com/ssd.html Netragard ...



Only top voted, non community-wiki answers of a minimum length are eligible